6fb0c80e2deb0673b360d5680e8fe03d306975dbf128d722beba3393b0d9c00e

Analysis

max time kernel
97s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2024 01:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d086bd6f3e40105c550a13f0de8b1bc_JaffaCakes118.exe
Size

953KB
MD5

3d086bd6f3e40105c550a13f0de8b1bc
SHA1

f9ac8e754e569eb672024ef953aee0d69a0be6e8
SHA256

6fb0c80e2deb0673b360d5680e8fe03d306975dbf128d722beba3393b0d9c00e
SHA512

4406d1659827cf1271b618167e712743b78162d0f2d237eb0ae2b5a17d83760621420de946e0623fab4830b8c21f85b400d02266672d20ae7bdc6346f109903c
SSDEEP

24576:OFWDhenrDQIn1Nc9YBnjaRdco4s0oOH8OgBPVnOA8dOkQ:pNen4uNc9injaRbco+XgNcOT

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2496	DomaIQ10.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3d086bd6f3e40105c550a13f0de8b1bc_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2496	DomaIQ10.exe
2496	DomaIQ10.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 796 wrote to memory of 2496	796	3d086bd6f3e40105c550a13f0de8b1bc_JaffaCakes118.exe	86
PID 796 wrote to memory of 2496	796	3d086bd6f3e40105c550a13f0de8b1bc_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\3d086bd6f3e40105c550a13f0de8b1bc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3d086bd6f3e40105c550a13f0de8b1bc_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:796
- C:\Users\Admin\AppData\Local\Temp\Doma\VAFPlayer_087\DomaIQ10.exe
  C:\Users\Admin\AppData\Local\Temp\Doma\VAFPlayer_087\DomaIQ10.exe /path="C:\Users\Admin\AppData\Local\Temp\3d086bd6f3e40105c550a13f0de8b1bc_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Doma\VAFPlayer_087\DomaIQ10.exe

Filesize
337KB

MD5
837cd0fdd95a97e37b8c86b0b5adaa03

SHA1
ec2904bfd56f83def5e9ee22cfa09c12bd8a86f7

SHA256
a4fad1d2e99847aa829464e3d6447bff305f6fa9c6eaa82954b320ac79c8030f

SHA512
13e20b79dfb95a6920cf0be15a0f1b139b4154df965a4c700defaac21d8fb407938775fc10053dc61411284f835171d1ee9bc41060207a98fdaedbf341599a7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Doma\VAFPlayer_087\config.dll

Filesize
32B

MD5
2988cf9b20f7ece761add45dde23e189

SHA1
6d7f25bc811414434961079fc58eaf30c71e6013

SHA256
216b6f4f5dfd5f867154fdeb6a70d410052acbc2512f95cde4d94fb54caba2b4

SHA512
a7bbb2c110fa0e42310dd015a81e276216943c54976be7bbd8fd50e31c4c04e990afa18cb8b72da42c8ced90692821d803407d4d6b7b1f76d1285e581ef12ac9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Doma\VAFPlayer_087\routes.dll

Filesize
257B

MD5
8fc132d017671cb9f0322ef97411aed7

SHA1
ec7587f1ce58736442912f1152fcc76c735eb26c

SHA256
a5d0ce7bd7d4c43cb49c2a76ceef62fe78733c22ad6132da73a871f29aeb5280

SHA512
2d5145b253ca05f3b28bb35dac53611cb7513b0502f01307cd47e592789abe85f68e6c8a312e5b319a34a0e10be6fb60b42cbf0b6084c43a07fdb96196192d37

Download Submit
memory/2496-12-0x000000001C050000-0x000000001C51E000-memory.dmp

Filesize
4.8MB

Download
memory/2496-19-0x00007FFF763C0000-0x00007FFF76D61000-memory.dmp

Filesize
9.6MB

Download
memory/2496-10-0x00007FFF763C0000-0x00007FFF76D61000-memory.dmp

Filesize
9.6MB

Download
memory/2496-13-0x000000001C5C0000-0x000000001C65C000-memory.dmp

Filesize
624KB

Download
memory/2496-14-0x00000000014C0000-0x00000000014C8000-memory.dmp

Filesize
32KB

Download
memory/2496-15-0x00007FFF763C0000-0x00007FFF76D61000-memory.dmp

Filesize
9.6MB

Download
memory/2496-16-0x00007FFF763C0000-0x00007FFF76D61000-memory.dmp

Filesize
9.6MB

Download
memory/2496-17-0x00007FFF763C0000-0x00007FFF76D61000-memory.dmp

Filesize
9.6MB

Download
memory/2496-18-0x00007FFF763C0000-0x00007FFF76D61000-memory.dmp

Filesize
9.6MB

Download
memory/2496-11-0x00007FFF763C0000-0x00007FFF76D61000-memory.dmp

Filesize
9.6MB

Download
memory/2496-20-0x00007FFF763C0000-0x00007FFF76D61000-memory.dmp

Filesize
9.6MB

Download
memory/2496-21-0x000000001D700000-0x000000001D762000-memory.dmp

Filesize
392KB

Download
memory/2496-9-0x0000000001280000-0x0000000001290000-memory.dmp

Filesize
64KB

Download
memory/2496-8-0x00007FFF76675000-0x00007FFF76676000-memory.dmp

Filesize
4KB

Download
memory/2496-24-0x00007FFF763C0000-0x00007FFF76D61000-memory.dmp

Filesize
9.6MB

Download
memory/2496-25-0x00007FFF76675000-0x00007FFF76676000-memory.dmp

Filesize
4KB

Download
memory/2496-26-0x00007FFF763C0000-0x00007FFF76D61000-memory.dmp

Filesize
9.6MB

Download
memory/2496-29-0x00007FFF763C0000-0x00007FFF76D61000-memory.dmp

Filesize
9.6MB

Download